---
title: stack kb security-timeline-api get-notes cli command
description: Get notes Behaviour flags: --dry-run — validate all inputs and exit without performing any action 
url: https://www.elastic.co/elastic/docs-builder/docs/4089/reference/elastic-cli/cli/stack/kb/security-timeline-api/get-notes
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview
---

# stack kb security-timeline-api get-notes cli command
<cli-modifiers>
</cli-modifiers>

```bash
elastic stack kb security-timeline-api get-notes [options]
```

Get notes
**Behaviour flags:**
`--dry-run` — validate all inputs and exit without performing any action

## Options

<definitions>
  <definition term="--document-ids string">
    Event document `_id` values to match against each note's `eventId`. When this parameter is present, the response is all matching notes (up to the server's hard limit), not a paged list using `page`/`perPage`.
    **Repeatable:** pass `--document-ids` multiple times to supply more than one value
  </definition>
  <definition term="--saved-object-ids string">
    Timeline `savedObjectId` value(s). Returns notes that reference those timelines. When present, list-mode pagination parameters are not used; up to the server's hard limit of notes may be returned.
    **Repeatable:** pass `--saved-object-ids` multiple times to supply more than one value
  </definition>
  <definition term="--page string">
    Page number for list mode (when `documentIds` and `savedObjectIds` are omitted). Passed as a string; default 1.
  </definition>
  <definition term="--per-page string">
    Page size for list mode (when `documentIds` and `savedObjectIds` are omitted). Passed as a string; default 10.
  </definition>
  <definition term="--search string">
    Search string for saved-objects find (list mode only).
  </definition>
  <definition term="--sort-field string">
    Field to sort by for saved-objects find (list mode only).
  </definition>
  <definition term="--sort-order string">
    Sort order (`asc` or `desc`) for saved-objects find (list mode only).
  </definition>
  <definition term="--filter string">
    Kuery filter string combined with other list-mode filters (for example `createdByFilter` or `associatedFilter`). Typed as a string for API compatibility; interpreted by the saved-objects layer (list mode only).
  </definition>
  <definition term="--created-by-filter string">
    Kibana user profile **UID** (UUID). The server resolves the user's display identifiers and returns notes whose `createdBy` matches any of them (list mode only).
  </definition>
  <definition term="--associated-filter enum">
    Restricts notes by how they relate to a Timeline and/or an event document (list mode only). Some values apply extra filtering after the query. Ignored when `documentIds` or `savedObjectIds` is used.
    **Values:** all, document_only, saved_object_only, document_and_saved_object, orphan
  </definition>
  <definition term="--input-file string">
    path to a JSON file to use as command input
  </definition>
  <definition term="--dry-run">
    validate all inputs and exit without performing any action (preview changes without applying them)
  </definition>
</definitions>


## Global Options

<definitions>
  <definition term="--json">
    output as JSON
  </definition>
</definitions>